make package metadata public

verification relies on this data being public or else we have to have another IAM account with read access. We make this info public one way or another anyway, so defaulting to public isn't leaking otherwise secret info.